Brand impersonation: Adobe (QR code)

type.inbound
and (
  any(attachments,
      (.file_type in $file_types_images or .file_type == "pdf")
      and (
        any(ml.logo_detect(.).brands,
            .name == "Adobe" and .confidence in ("medium", "high")
        )
        or any(ml.logo_detect(beta.message_screenshot()).brands,
               .name == "Adobe"
        )
        or any(file.explode(.),
               any(.scan.strings.strings,
                   regex.icontains(., "adobe (acrobat|sign)")
                   // negate PDF data, like "xmp:CreatorTool>Adobe Acrobat Pro (64-bit) 24.4.20272</xmp:CreatorTool>"
                   and not regex.icontains(.,
                                           "(creatortool|producer|creator).{1,5}adobe acrobat"
                   )
               )
        )
      )
  )
  or any(attachments,
         .file_extension in $file_extensions_macros
         and any(file.explode(.), .depth == 0 and .scan.docx.image_count > 0)
         and any(file.explode(.),
                 any(.scan.strings.strings, strings.ilike(., "*adobe*"))
         )
  )
)
and any(attachments,
        (
          .file_type in $file_types_images
          or .file_type == "pdf"
          or .file_type in $file_extensions_macros
        )
        and (
          any(file.explode(.),
              regex.icontains(.scan.ocr.raw, 'scan|camera')
              and regex.icontains(.scan.ocr.raw, '\bQR\b|Q\.R\.|barcode')
          )
          or (
            any(file.explode(.),
                .scan.qr.type == "url"
                // recipient email address is present in the URL, a common tactic used in credential phishing attacks 
                and any(recipients.to,
                        (
                          (
                            .email.domain.valid
                            and (
                              strings.icontains(..scan.qr.data, .email.email)
                              or any(beta.scan_base64(..scan.qr.data, format="url"),
                                     strings.icontains(., ..email.email)
                              )
                            )
                          )
                          or strings.icontains(.display_name, "undisclosed")
                        )

                        // the recipients sld is in the senders display name
                        or any(recipients.to,
                               strings.icontains(sender.display_name,
                                                 .email.domain.sld
                               )
                        )

                        // the recipient local is in the body  
                        or any(recipients.to,
                               strings.icontains(body.current_thread.text,
                                                 .email.local_part
                               )
                        )

                        // or the body is null 
                        or body.current_thread.text is null
                        or body.current_thread.text == ""

                        // or the subject contains authentication/urgency verbiage
                        or regex.contains(subject.subject,
                                          "(Authenticat(e|or|ion)|2fa|Multi.Factor|(qr|bar).code|action.require|alert|Att(n|ention):)"
                        )

                        // high confidence cred theft in body
                        or any(ml.nlu_classifier(body.current_thread.text).intents,
                               .name == "cred_theft" and .confidence in ("high")
                        )
                )
            )
          )
        )
)
and (
  not any(headers.hops,
          .authentication_results.compauth.verdict is not null
          and .authentication_results.compauth.verdict == "pass"
          and sender.email.domain.root_domain in (
            "acrobat.com",
            "adobecc.com",
            "adobecces.com",
            "adobeccstatic.com",
            "adobe.com",
            "adobeexchange.com",
            "adobe-identity.com",
            "adobe.io",
            "adobejanus.com",
            "adobelogin.com",
            "adobe.net",
            "adobeprojectm.com",
            "adoberesources.net",
            "adobesc.com",
            "adobesign.com",
            "adobestock.com",
            "createjs.com",
            "licensingstack.com",
            "myportfolio.com",
            "photoshop.com",
            "typekit.com",
            "typekit.net"
          )
  )
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)